Apply Pod Security Standards at the Cluster Level | Kubernetes

Pod Security is an admission controller that carries out checks against the Kubernetes Pod Security Standards when new pods are created. It is a feature GA'ed in v1.25. This tutorial shows you how to enforce the baseline Pod Security Standard at the cluster level which applies a standard configuration to all namespaces in a cluster.
To apply Pod Security Standards to specific namespaces, refer to Apply Pod Security Standards at the namespace level.
If you are running a version of Kubernetes other than v1.37, check the documentation for that version.
Install the following on your workstation:
This tutorial demonstrates what you can configure for a Kubernetes cluster that you fully control. If you are learning how to configure Pod Security Admission for a managed cluster where you are not able to configure the control plane, read Apply Pod Security Standards at the namespace level.
Pod Security Admission lets you apply built-in Pod Security Standards with the following modes: enforce, audit, and warn.
To gather information that helps you to choose the Pod Security Standards that are most appropriate for your configuration, do the following:
Create a cluster with no Pod Security Standards applied:
The output is similar to:
Set the kubectl context to the new cluster:
The output is similar to this:
Get a list of namespaces in the cluster:
The output is similar to this:
Use --dry-run=server to understand what happens when different Pod Security Standards are applied:
The output is similar to:
The output is similar to:
The output is similar to:
From the previous output, you'll notice that applying the privileged Pod Security Standard shows no warnings for any namespaces. However, baseline and restricted standards both have warnings, specifically in the kube-system namespace.
In this section, you apply the following Pod Security Standards to the latest version:
The baseline Pod Security Standard provides a convenient middle ground that allows keeping the exemption list short and prevents known privilege escalations.
Additionally, to prevent pods from failing in kube-system, you'll exempt the namespace from having Pod Security Standards applied.
When you implement Pod Security Admission in your own environment, consider the following:
Based on the risk posture applied to a cluster, a stricter Pod Security Standard like restricted might be a better choice.
Exempting the kube-system namespace allows pods to run as privileged in this namespace. For real world use, the Kubernetes project strongly recommends that you apply strict RBAC policies that limit access to kube-system, following the principle of least privilege. To implement the preceding standards, do the following:
Create a configuration file that can be consumed by the Pod Security Admission Controller to implement these Pod Security Standards:
Configure the API server to consume this file during cluster creation:
Create a cluster that uses Pod Security Admission to apply these Pod Security Standards:
The output is similar to this:
Point kubectl to the cluster:
The output is similar to this:
Create a Pod in the default namespace:
The pod is started normally, but the output includes a warning:
Now delete the clusters which you created above by running the following command:
Was this page helpful?
Thanks for the feedback. If you have a specific, answerable question about how to use Kubernetes, ask it on Stack Overflow. Open an issue in the GitHub Repository if you want to report a problem or suggest an improvement.
© 2026 The Kubernetes Authors | Documentation Distributed under CC BY 4.0
© 2026 Copyright © Kubernetes a Series of LF Projects, LLC. For website terms of use, trademark policy and other project policies please see https://lfprojects.org/policies/
ICP license: 京ICP备17074266号-3